Summary

  • The abuse contact displayed for Svea's legacy netblock 193.105.138.0/24 is a shared mailbox on a third party's domain, rendered by third-party mirrors and validated under RIPE policy only for technical deliverability — reception, not handling.
  • No public source located for this investigation documents that mailbox receiving, answering, escalating or remediating any report for this block; the absence of evidence is an evidential boundary, not proof the mailbox never functioned.
  • The only demonstrable accountability event against Svea Bank AB is Finansinspektionen's remark plus a SEK 170 million sanction fee, announced 17 December 2025, for anti-money-laundering breaches — a regulatory channel wholly separate from the registry contact surface.

A contact that exists in the registry

The routed legacy block 193.105.138.0/24 — netname SVEA-EKONOMI-SE, associated with AS211899 — presents, across the third-party mirrors checked for this file, an abuse contact rendered as a mailbox on the Verizon Business domain se.verizon.com (IPIP.NET mirror, IPgeolocation AS211899 page, IPinfo route page). That domain belongs to the carrier lineage UUNET/MCI–Verizon Business, not to Svea. The same Verizon-domain mailbox has appeared as the abuse contact for netblocks belonging to organisations with no relationship to Svea. In other words: what a network abuse investigator consulting the public record would find is a carrier-era shared mailbox, not a dedicated channel into the Swedish bank group.

A caveat belongs at the front of this file. Every RIPE database value cited here comes from third-party mirror renderings; the authoritative RIPE Database query interface could not be directly retrieved during this investigation (query landing page). The mirrors also disagree with each other: at the autonomous-system level, different aggregators render either a personal svea.com mailbox or a role object. Both cannot describe the same accountable party. What the mirrors agree on is the pattern — a contact surface that is shared, inherited and not Svea-specific.

What validation actually proves

RIPE policy — the ripe-705 document and its predecessor proposals 2017-02 and 2019-04 — requires a sponsoring LIR to maintain a single validated abuse mailbox for its customers, validated at least annually (RIPE Labs on abuse-c validation). The validation tests syntax, domain and mail-server configuration: that a message can be delivered. It does not test whether anyone reads the message, whether the mailbox is monitored, whether reports are triaged, escalated or remediated (RIPE NCC abuse support, LIR basics on abuse reports). Validation is a deliverability certificate, not a service-level agreement.

This distinction matters for boards and regulators assessing whether a prevention-and-detection channel exists. Under the public record, the Svea block's contact surface clears the only test the registry applies — and that test is the weakest one available. There is no public mechanism in the RIPE framework that would surface whether the mailbox operates beyond deliverability.

The search for documented processing

This investigation searched for any public source documenting that the Verizon-domain mailbox for 193.105.138.0/24 received a report, responded, escalated or produced a remediation outcome. None was found. Prior BTW coverage of this subject (contact durability, control split) reached the same boundary from the registry side. The absence is real but bounded: it is an evidential absence in public sources, not a demonstration that the mailbox never worked. What can be stated with confidence is that nothing in the public record distinguishes this contact from a registry-only artefact.

Where accountability demonstrably fired

The contrast is Finansinspektionen, Sweden's financial supervisor. On 17 December 2025 it issued Svea Bank AB (registration number 556158-7634) a remark and an administrative sanction fee of SEK 170 million for breaches of central anti-money-laundering provisions (FI announcement, Swedish, FI announcement, English). The formal decision, issued under 15 kap. 7 § of the Banking and Financing Business Act (2004:297), records the fee, states that the statutory maximum would have been about SEK 627 million — ten percent of the group's 2024 turnover of roughly SEK 6,271 million — and notes the appeal route to the Administrative Court in Stockholm (sanction decision PDF).

The underlying investigation covered 30 April 2022 to 1 May 2023 and was limited to business directed at corporate (legal-person) customers. FI found deficiencies in the general risk assessment, the customer risk assessment, and customer due diligence — including failure to establish beneficial owners as required and, for a large share of reviewed high-risk customers, no or insufficient or too-late enhanced due diligence (FI investigation summary). FI judged the violations not serious enough to consider withdrawing the banking authorisation or issuing a warning, and declined Svea's arguments about measures already taken as grounds to refrain from intervening, a decision recorded alongside other supervisory measures in FI's public register of decisions and measures.

Svea Bank's own response confirms receipt; CEO Lennart Ågren describes AML and counter-terrorist-financing work as highly prioritised and says the decision does not change the bank's offering or direction (issuer statement). That statement is an issuer communication, not independent verification of remediation.

The remedy-channel contrast

Two channels, two very different evidentiary postures. The registry contact channel has, in public sources, no documented operational event at all — no received report, no response, no escalation, no remedy. The regulatory channel has a dated decision, quantified fine, legal basis, investigation window, named deficiencies and a documented appeal route. When Svea Bank AB was held to account, it was not because of the abuse-contact surface; it was a separate supervisory machinery with the power to investigate, quantify and publish. The abuse mailbox, meanwhile, sits in the record as a deliverability certificate attached to a carrier-era domain.

For anyone relying on the public registry to route abuse reports against this block, the practical question is not whether the record is "valid" — it is. The question is whether validity ever translated into an accountable human response. The public record gives no basis for assuming it did.